So, he essentially tricked some social media manager into giving him a password (probably the same used for both). That's even weaker than I expected.